GET Identity Providers

The client secret of the service account that Keyfactor Command uses to make API calls to the identity provider.

For Keyfactor Identity Provider, this is created as a client (see Service Accounts).

This parameter is required.

The unique identifier defined in Auth0 or a similar identity provider for the API.

This parameter only appears if Auth0 is selected as the type and is required in that case.

The authorization endpoint URL for the identity provider.

For Keyfactor Identity Provider, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation). It is automatically returned by the Discovery Document Endpoint Fetch step. Review it to confirm that it appears correct.

This parameter is required.

The secret for the client application created in the identity provider for primary application use.

For Keyfactor Identity Provider, see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation for help locating this. It is automatically returned by the Discovery Document Endpoint Fetch step. Review it to confirm that it appears correct.

Supported methods to store secret information are:

• Store the secret information in the Keyfactor secrets table.

  A Keyfactor secret is a user-defined username or password that is encrypted and stored securely in the Keyfactor Command database.

• Load the secret information from a PAM provider.

  See Privileged Access Management (PAM) for more information.

For example, a username stored as a Keyfactor secret will look like:

{
   "SecretValue": "KEYEXAMPLE\svc_MyServiceName"
}

For example, a password stored as a Keyfactor secret will look like:

{
   "SecretValue": "MySuperSecretPassword"
}

A secret stored as a CyberArk PAM secret will look like (where the Provider value—1 in this example—is the Id value from GET PAM Providers and the Safe, Folder, and Object reference the information in the CyberArk safe needed for this record):

{
   "Provider": "1",
   "Parameters":{
      "Safe":"MySafeName",
      "Folder":"MyFolderName",
      "Object":"MyObjectName"
   }
}

A secret stored as a Delinea PAM secret will look like (where the Provider value—2 in this example—is the Id value from GET PAM Providers and the SecretId and SecretFieldName contain the information created in the Delinea secret server for this purpose):

{
   "Provider": "2",
   "Parameters":{
      "SecretId":"MyId"
      "SecretFieldName":"MyReferenceName"
   }
}

This parameter is required.

This parameter is required.

The name used to reference the type of user claim for the identity provider.

For Keyfactor Identity Provider, this should be:

This parameter is required.

One or more scopes that are requested during the OIDC protocol when Keyfactor Command is the relying party. Multiple scopes should be separated by spaces.

This value is not used for Keyfactor Identity Provider.

The token endpoint URL for the identity provider.

For Keyfactor Identity Provider, this is included among the information that can be found on the OpenID Endpoint Configuration page, a link to which can be found on the Realm Settings page (see Configuring Keyfactor Identity Provider and Collecting Data for the Keyfactor Command Installation). It is automatically returned by the Discovery Document Endpoint Fetch step. Review it to confirm that it appears correct.

This parameter is required.

This parameter is required.